Your Privacy When Shopping for Legal Cannabis on OCS.ca

Last updated November 24, 2025 | Published on November 24, 2025 

Consumers are becoming savvier — and more concerned — about how personal information is collected and used across the internet. The Office of the Privacy Commissioner of Canada’s most recent poll on Canadians’ perceptions of privacy paints a telling picture: Just 40% of us believe retailers protect our privacy rights, and 62% think the government does.

As an Ontario Crown corporation, the Ontario Cannabis Store (OCS) is both a retailer and a government agency, and that gives us specific obligations when it comes to protecting your personal information as a consumer.

Building trust in the legal cannabis industry takes a robust, responsible approach to data privacy. Our promise: When you visit OCS.ca, we only collect the data we need to offer a safe, smooth cannabis shopping experience.

Keep reading to learn more about how the OCS manages and protects your personal information and privacy.

What is personal information?

Personal information (PI) is recorded information about an identifiable individual in a personal capacity. It reveals something of a personal nature about you, and it could reasonably identify you if disclosed —  for example, your name, email address, credit card information or browsing data.

What information the OCS collects

The OCS and the third-party service providers we have engaged to help us conduct our business, including Shopify Inc., may collect your personal information when you choose to, for example:

• make a purchase on OCS.ca
• create an OCS My Account
• contact OCS customer service by email, phone or Chat
• subscribe to an OCS newsletter
• participate in OCS surveys or promotions

We collect the following information in order to process your purchase and deliver products you ordered on OCS.ca:

• full name
• phone number
• email address
• home and delivery address
• order information
• delivery-related information, such as signature and ID type at the time of delivery

Where your personal information goes

When you make a purchase from OCS.ca, it’s processed by Shopify and fulfilled by the OCS and our delivery partners.

Shopify collects information such as your name, address and email address, and transfers it to the OCS system for processing. We then share that information with our supply chain partners to deliver your order to you. Any information our partners collect is securely stored in their systems.

It’s not required to make a purchase, but if you do choose to create a user account on OCS.ca, Shopify may store additional information, such as your transaction history. Read more about Shopify’s privacy and security policies, which are updated occasionally.

How your personal information is used

The OCS and its partners never sell customers’ personal information. We collect only the personal information that’s needed to enable the online sale and delivery of products — nothing else.

The OCS and its service provider partners use your personal information to:

• process OCS.ca orders and payments
• deliver orders
• verify your age and identity on OCS.ca and at the door upon delivery
• improve customer service
• send order updates
• send promotional offers (if you opt in)
• analyze website usage to enhance your user experience
• comply with legal and regulatory requirements
• protect you and the OCS from fraud

Our transaction processor, Shopify, does not store consumer payment information. None of our providers are permitted to use our customers’ PI for any other reason outside of providing the services we've engaged that vendor for.

How long your personal information is saved

Your personal information is kept for only as long as it’s needed to accomplish the purpose it was collected for, as well as to fulfill any of our any legal obligations.

If you have created an OCS.ca My Account, we keep your information while the account is active. If you deactivate your account, we will only retain your PI as long as we are required to by law.

How we protect your personal information

Provincial privacy legislation states that PI must only be collected for a legitimate, lawful purpose. Federal privacy law also provides strict guidelines on keeping, storing and using data.

The OCS’s approach to data privacy and risk management goes above and beyond provincial and federal privacy requirements. We use “privacy by design,” an approach that embeds privacy into the design, functioning and core of what we do at OCS.ca.

As part of our proactive work on identifying and preventing privacy risks, such as data breaches, the OCS protects your PI through:

• clearly communicating why and when we collect your personal information by providing the OCS Privacy Statement, and OCS.ca and OCS Email Newsletter Terms and Conditions online, written in plain language to ensure everyone understands how we manage their data
• completing Privacy Impact Assessments for initiatives that involve the collection, access, use, disclosure, storage or deletion of personal information
• limiting access to PI to authorized personnel only
• requiring our partners to use the same privacy standards

Who we share your information with

The OCS may share your personal information with:

• authorized service providers, such as payment processors and delivery services
• analytics and marketing partners, only with your consent

It’s important to know that as a public agency, the OCS must comply with the Freedom of Information and Protection of Privacy Act (FIPPA), giving Ontarians the right to request information from our institution. You can request access to your own PI or general information. It is important to note that some information may not be disclosed through the access process. Privacy laws in Ontario prohibit disclosing information that may invade individuals’ privacy. In short, the OCS can’t, and won’t, release shoppers’ personal information in Freedom of Information access requests.

Your privacy choices

You have options to manage some of the ways your PI is collected on OCS.ca. You can:

• opt in or out of marketing emails
• update or delete your My Account information
• request access to your personal data
• withdraw consent for data collection (if you have signed up for marketing emails)
• update your browser settings, including clearing cookies

If you have any questions or concerns about the privacy of your personal information, want to request general records or your own personal information, or make a correction to your PI, contact the OCS Customer Service Centre at 1-888-910-0627.

How we use cookies

We use web cookies to help us understand how consumers use our website and to facilitate browsing. If you opt in to cookie usage, we use your browsing behaviour on OCS.ca to see how you found us, whether you’ve been on our site before and what products you click on.

That said, our web analytics service doesn’t let us or our providers identify any individuals. You can also adjust your cookie settings at any time.

When you sign into your My Account, we use information gathered with cookies to improve your retail experience, mainly by displaying relevant products and information. If you opt in to receive marketing emails, such as the OCS newsletter, your personal information is also used to personalize those emails to you.

FAQs about privacy and buying legal cannabis on OCS.ca

Q: Will buying cannabis legally in Ontario limit my ability to travel in the future?

A: The OCS does not have control over the types of questions consumers will be asked when travelling. Make sure you stay informed about the cannabis restrictions in the countries you plan to travel within.

That said, the OCS does take the protection of your personal information (PI) seriously and does not disclose it to unauthorized individuals or institutions. We use physical, technological and organizational security measures, including restricting access to locations with records containing PI, using strong passwords and providing mandatory staff training on how to handle consumer information securely.

Q: How is buying from the OCS safer than illegal websites in terms of data privacy? I doubt illegal sites are saving my personal information for any reason.

A: The OCS has always been committed to protecting customers’ privacy and ensuring the confidentiality of the PI we collect, and continuously improving our privacy program to serve you better. We strive to clearly communicate to you when and why we collect your information and ensure access to your PI is limited and secure.

We do this by completing Privacy Impact Assessments on systems that involve the collection, use, disclosure, storage or deletion of PI. By proactively identifying privacy risks, we work to prevent unauthorized use or disclosure of any consumer PI. However, if this does occur, we have robust processes that trigger immediate action, ensuring we quickly and carefully contain and investigate the situation, notify those involved and provide a solution.

Illegal websites are not required to adhere to the strict compliance the OCS maintains as part of our responsibilities to consumers. These sites may ask you to upload your ID or share your banking details for payment, and don’t have the same comprehensive policies or oversight we employ on your behalf.